Harry Hsiung

11/3/2016

Presentation will be posted at

http://www.uefi.org under Education

http://www.uefi.org/learning_center/presentationsandvideos/

UEFI and Linux Interoperability

Agenda

Who does UEFI

Latest specifications

Latest efforts in the code

Work to be done

Where do you get UEFI

Testing UEFI for Linux

The UEFI Forum

3

Board of Directors (12 Promoters)

Industry & Communications (ICWG)

UEFI Specification (USWG)

Security Subteam (USST)

Configuration Subteam

Network Subteam (UNST)

Shell Subteam

ARM Binding Subteam

Platform Initialization (PIWG)

Security Subteam

Test (UTWG)

Officers:

President: Mark Doran (Intel); VP (CEO): Dong Wei (HPE)

Secretary: Jeff Bobzin (Insyde); Treasurer: Bill Keown (Lenovo)

12 Promoters

41 Contributors

221 Adopters

36 Individual Adopters

Total: 310

ACPI Specification (ASWG)

Security Response Team (USRT)

NVDIMM Subteam

UEFI membership

Plugfest gatherings of all UEFI members once a year in USA

(Seattle) and usually in Taipei.

http://www.uefi.org/events

Some presence also at Linuxcon and OCP summit.

Specifications and code

6

UEFI 2.0

PI 1.0

UEFI 2.1

PI 1.1

UEFI 2.3 UEFI 2.2

EDK 1.01: UEFI 2.0

Shell 2.0

PI 1.2

Packaging 1.0

EDK 1.04: UEFI 2.1

PI 1.0

Sp

ecif

icati

on

s

Imp

lem

en

tati

on

http://uefi.org

http://tianocore.org https://github.com/tianocore/edk2

EDK 1.06: UEFI 2.1+

PI 1.0

SCT

PI 1.0

SCT UEFI 2.0

UDK2010: UEFI 2.3

PI 1.2

EDK II*: UEFI 2.1+

PI 1.0

2006 2007 2008 2009 2010 2011-16

SCT UEFI 2.1

UEFI 2.3.1

UDK2016

UEFI 2.6

PI 1.4

SCT UEFI 2.3

UEFI 2.6

PI 1.4

ACPI6.1

FSP2.0

Latest UEFI &

ACPI Specifications (Q3 2016)

7

http://uefi.org/specifications

UEFI 2.6

ACPI 6.1

UEFI Shell 2.2

UEFI PI 1.4

UEFI PI Packaging 1.1

What’s Not So New UEFI 2.5 … needs coding

But needs to be tested

UEFI 2.5 Network Enhancements

Boot from HTTP

HTTP API

HTTP Helper API

DNS v4/6

RAM Disk Device Path

Code in staging area of EDK2 Tianocore.org

WiFi

EAP Support

TLS (Https)

Bluetooth (BLE for hid only)

REST Protocol (Redfish DMTF) http://redfish.dmtf.org/

8

What’s New in UEFI 2.6

UEFI v2.6

Network Enhancements

Wireless MAC Connection II Protocol

RAM Disk Protocol

RAS

CPER Extension for ARM

User Interface

HII Font Ex, Glyph Generator, Image Ex and Image

Generator Protocols

IO

SD/eMMC Pass Thru Protcol

Non-identity Mapped Address Translations in PCI Root

Bridge and IO Protocols 9

What’s New besides UEFI

ACPI v6.1

Persistent Memory

NFIT Updates

NFIT Root Device _DSM

RAS

APEI Extension for ARM

ERST/EINJ max wait time

Management

Graceful Shutdown Clarifications

Wireless Power Calibration Device

IO

Interrupt-signaled Events

10

UEFI Secure Boot vs. TCG Trusted Boot

UEFI authenticate OS

loader

(pub key and policy)

Check signature of

before loading

• UEFI Secure boot will stop

platform boot if signature not

valid (OEM to provide

remediation capability)

• UEFI will require remediation

mechanisms if boot fails

UEFI PI will measure OS

loader & UEFI drivers into

TPM (1.2 or 2.0) PCR

(Platform Configuration

Register)

• Incumbent upon other

software to make security

decision using attestation

UEFI Firmware

UEFI OS Ldr,

Drivers

Kernel

Drivers

Apps

TPM

reco

rd in

PC

R

Secure Boot Implementation

Microsoft* UEFI CA certificate

Signature generated from Microsoft UEFI CA

Fedora* CA certificate

Signature generated from Fedora CA

SUSE* Approach to UEFI Secure

Boot SUSE has to balance two goals

Improving enterprise security by adopting UEFI Secure Boot

Reconcile UEFI Secure Boot with Linux developer’s need to run a custom boot loader & kernel

Aiming to support Secure Boot in SLE11 SP3* and openSUSE*

Working with Linux* community and other vendors Building on the shim loader created

by Matthew Garrett

Extending it to allow machine owner to securely boot other kernels

TCG 2.0 (trusted computing group)

UEFI only specifies a signed boot (secure boot)

TCG provides spec for measured boot (static root of trust) PC client Specific Platform Firmware Profile spec

https://www.trustedcomputinggroup.org/wp-content/uploads/PC-ClientSpecific_Platform_Profile_for_TPM_2p0_Systems_v21.pdf

Pc client work group EFI protocol specification https://www.trustedcomputinggroup.org/tcg-efi-protocol-specification/

Today systems ship with 1.2 TPMs

Updated specs now provided for 2.0 TPMs

http://www.uefi.org/sites/default/files/resources/Phoenix_Plugfest_Fall_2016.pdf

http://www.uefi.org/sites/default/files/resources/Phoenix_Plugfest_TPM2_March_2016.pdf (delta of changes for UEFI)

Still in public review https://www.trustedcomputinggroup.org/specifications-public-review/

TPM Specification, Version 2.0, Revision 135

Trusted Execution Environment

TrEE (1.0)

EFI protocol to allow OS (bootloader) to: Check TPM related firmware capabilities

Obtain TCG measured boot log

Add measurements to log and extend into TPM

PCRs

Pass TPM commands to TPM device

15

TrEE 1.0 -> TCG2.0 Added support for crypto-agile functionality

Switch active TPM PCR banks

Obtain crypto-agile TCG measured boot

log

Same GUID as TrEE 1.0 protocol

Get capability API reports new version

number

Allowing firmware to implement one

protocol

Caller can use different subset of

functionality based on reported version 16

Customized UEFI Secure boot

Starting in UEFI 2.5/2.6 versions

17

Deployment

Benefits • No specific solution Security

• Higher utilization Flexibility

• Verification status Extensibility

Initial Advanced

Platform Specific

PKpub Clear

Standardized solution to

customize the secure boot

keys

Setup Mode

User Mode

Setup Mode User Mode

Audit Mode

Deployed Mode

Customized UEFI Secure Boot reduces the security risk introduced by platform specific solutions. Working w/ OS vendors on interoperability and readiness.

https://github.com/tianocore/edk2-staging/tree/Customized-Secure-Boot

Customized Deployment of

Secure Boot

Configure Secure Boot options

programmatically

Enterprise admins can set and deploy

PK/KEK/db/dbx/[future Secure Boot

variables]

Uses new Secure Boot modes from UEFI

2.5 Section 30.3

Setup, User, Deployed, Audit

Relies on PCR[7] in TPM 2.0

UEFI Plugfest –

September 2016

www.uefi.org 18

Customized Deployment of Secure Boot

tentative timeline

Estimate Checkpoint

09-2016 UEFI spec fix ECR drafted

11-2016 TCG spec stabilized

12-2016 UEFI spec fix published

02-2017 Tianocore production branch stabilized and verified

03-2017 IBVs receive Tianocore

05-2017 IBVs ready to support Customized Deployment of Secure Boot

08-2017 OEMs start shipping devices with the Customized Deployment of

Secure Boot feature

19

Secure firmware update

(ESRT capsule)

20

Firmware update protected by: OS verify the update

driver when creating capsule

UEFI secure boot verify capsule payload before performing update

What’s new: ESRT FMPv3 FMP capsule

{ Camera GUID1, VersionInfo }{ G-Sensor GUID2, VersionInfo }

{ System Firmware GUID3, VersionInfo }

…...

UEFI Firmware Resource Table(ESRT)

Camera G-Sensor System firmware

Updated Data(Optional)

Update UEFI driver

(Optional)

UPDATE

RoutingInfo

FMP Capsule

HTTP Stack

21

New Modules

Driver Library

HTTP Boot Driver

HTTP Driver

HTTP Utilities Driver

TLS Driver

HTTP Library

TlsLib Library

OpenslTlsLib Library

• Flexible Network Deployment

• Home Environment Support

• Corporate Environment

Support

https://github.com/tianocore/edk2-staging/tree/HTTPS-TLS

https://github.com/tianocore/edk2/tree/master/NetworkPkg

HTTP-S boot

22

Booted!

DHCP Server DNS Server HTTP(S) ServerEFI HTTPBoot

Client

https://github.com/tianocore/edk2-staging/tree/HTTPS-TLS

https://github.com/tianocore/edk2/tree/master/NetworkPkg

Boot recovery

23

Start

OsIndications

OsRecovery####

Boot####

Boot to OS

SysPrep####

Boot####

All fail? All fail?

PlatformReco

very####

1: PlatformRecovery

2: OsRecovery

3: Not exist

No No

Yes Yes

What’s new OS defined

recovery Platform defined

recovery Recovery policy

protected by authentication OsRecoveryOrder dbrDefault, dbr

Default platform recovery supported

Security enhancements help in accelerating the

system startup stage

https://github.com/UEFI/uefiproto/tree/master/OsRecovery

What’s New in Shell 2.2

UEFI Shell v2.2

Network updates (for https boot)

Allow Execute() to not nest new shells

Add command line parameter to auto exit

New dh features

Setvar command re-factor

New command features for disconnect, comp,

dmem, cls, reset, pci, bcfg, dmpstore

Nvdimm support – mm

24

Putting it all together Having platforms with the features

Including OVMF

Minnow Galileo Others…

UEFI Specification cannot prescribe ‘how’ to build (i.e., ‘where is my NIST 800-147 reference) but platforms can demonstrate Windows Logo, Android CDD, NIST XYZ, ….

Security Bugs in EDKII code ->

https://github.com/tianocore/tianocore.github.io/wiki/Reporting-Security-Issues

In other code and/or specification -> http://uefi.org/security

25

Bringing in other scenarios Network based recovery

HTTP, Wireless, Recovery -> have OS’s and platforms doing it

Updates Capsule, network, REST – harmonize payload

between in-band and out of band http://www.uefi.org/sites/default/files/resources/OCPsummit2016_Towards%20a%20Firmware%20Update%20Standard.pdf and http://www.dmtf.org/sites/default/files/standards/documents/DSP0267_1.0.0a.pdf

IPXE scenarios – evolve UEFI Shell to provide parity to IPXE scripting?

26

Linux work list for UEFI ESRT (signed) firmware capsule update

OS passes payload of firmware to update in system

Https network

OS install from https server (instead of pxe) Ipxe support for scripting

OS booting from https server (instead of pxe)

OS recovery (ie cloud recovery) to restore OS and firmware

All of the above on Wifi networks for client

Security

Measured boot static root of trust with TPM 2.0 support

UEFI secure boot audit and deployment mode

Redfish support for Rest api (out of band deployment and support)

Where do you get UEFI Code lives on www.tianocore.org EDKII project

Snapshots labelled as UDK2015, UDK2016 ….

Mainly core code (UEFI protocols common to all implementations) Not complete trees for platforms

OVMF/QEMU and NT32 trees for development

New Bugzilla database

GCC/Clang/llvm tool chain added

Security reporting mechanism

Training documents for EDK2

Open source hardware designs

http://Firmware.intel.com/projects/minnowboard-

max

• ARM UEFi platforms

https://wiki.linaro.org/ARM/UEFI

MinnowboardMax (Baytrail-I) http://wiki.minnowboard.org/MinnowBoard_MAX

New Turbot ADI board version

http://www.adiengineering.com/products/minnowb

oard-turbot/

Lures (plugin cards) www.tincantools.com

Spi hook flash re-program/debug $29

Firmware source at Firmware.intel.com +

tianocore.org (Valleyview pkg).

Other firmware now

available(Uboot,coreboot, FSP etc.)

More UEFI hardware Rainbowpass S1200V3RPS (Haswell workstation)

http://www.Tunnelmountain.net

UEFI 2.5/2.6 code

Https support (wired lan only)

Ramdisk support

ESRT capsule update

TPM 2.0/1.2 support (LPC only)

Firmware at

https://firmware.intel.com/develop/server-development-kit

UEFI firmware testing

FWTS – linux firmware test suite from Ubuntu

Tests both UEFI and ACPI in a platform

https://wiki.ubuntu.com/FirmwareTestSuite

UEFI SCTs

UEFI org tests for spec compliance

http://www.uefi.org/testtools

Linux UEFI validation

https://01.org/linux-uefi-validation

References UEFI Fall Plugfest - September 20-22, 2016

http://www.uefi.org/learning_center/presentationsandvideos

Redfish Configuration of UEFI HII Settings - Mike Rothman (Intel) and Samer El

Haj Mahmoud (Lenovo)

Innovative Software Tools & Methods to Profile, Test and Optimze UEFI Firmware Improving Test Coverage and Debug Results - Kevin Davis (Insyde Software)

Out of Band BIOS Remote Management - Matthew Krysiak (AMI)

UEFI Forum Update - Dong Wei (HPE)

Microsoft UEFI Security Updates - Scott Anderson, Suhas Manangi, Nate Nunez, Jeremiah Cox, and Michael Anderson (Microsoft)

UEFI Open Source Community: tianocore.org update -Brian Richardson (Intel) and Leif Lindholm (Linaro)

UEFI Network and Security Update - Vincent Zimmer (Intel)

Updated TCG TPM 2.0 Specs - Dick Wilkins (Phoenix Technologies Ltd.)

ARM Trusted Firmware ARM UEFI SCT Update - Charles Garcia-Tobin (ARM)